A procurement questionnaire arrives from a client with a subsidiary in Dublin. Question fourteen asks the firm to list every artificial intelligence system it uses on the engagement, name who is accountable for each, and say whether any of them sit inside the European Union's AI Act. The partner signing the form cannot answer the first part, which leaves the rest unanswerable. That questionnaire, rather than a European regulator, is how the Act reaches most firms in England and Wales.
The Act is Regulation (EU) 2024/1689, and it arrived in stages. Prohibited practices and a duty on AI literacy applied from 2 February 2025. Obligations for general purpose AI models and the governance machinery followed on 2 August 2025. The main body became applicable on 2 August 2026.
Five days before that date the ground shifted. Regulation (EU) 2026/1744, the AI Omnibus, was published in the Official Journal on 24 July 2026 and entered into force three days later. It defers the high risk obligations on stand alone systems in Annex III to 2 December 2027, and those on AI built into regulated products to 2 August 2028. Those deferrals read as a general reprieve, and the part a professional business meets first stayed where it was. Transparency duties apply from this month, the rules on general purpose AI models continue, and the prohibitions stand. The literacy duty survives in lighter form, asking providers and deployers to support the development of AI literacy among their staff rather than guarantee a level in any individual.
Scope is what turns a European regulation into a British problem. The Act binds any provider placing an AI system on the Union market, wherever that provider sits, and any provider or deployer outside the Union whose system produces output used in the Union. Whether a Manchester firm sending AI assisted work to a client in Rotterdam falls inside that second limb turns on the facts, and in most firms nobody has looked. The ceilings give it weight, reaching 35 million euros or 7 per cent of worldwide annual turnover for a prohibited practice, and 15 million euros or 3 per cent for most other operator duties, with the lower figure applying to smaller enterprises.
What reaches a firm in England and Wales
The high risk machinery touches a law firm as a legal adviser less than the coverage suggests. The category covering the administration of justice reaches systems used by a judicial authority, or on its behalf, to research and interpret facts and law, which does not describe a firm drafting for its own client. What does reach an ordinary firm reaches it as an employer, because Annex III treats systems that filter job applications, evaluate candidates, allocate tasks or monitor performance as high risk. A firm running an automated sift over training contract applications sits there, and its date is now 2 December 2027, which buys time.
The discipline that answers it is dull and cheap. Keep one register of the AI in use across the firm. Each row names the tool, who authorised it, what client data it touches, whether its output reaches a client or crosses into the Union, whether a qualified person approves it before it leaves, and what the users were told about its limits. Decide which tools are sanctioned and record the decision, because a firm that has not decided runs whatever its staff signed up for. Starting it costs an afternoon, and it answers the client questionnaire, the insurer at renewal, and the obligations of competence and supervision the SRA already expects, none of which waits for December 2027.
Keeping the record where the work happens
The Bracton AI Assistant plugs into the case management or CRM system a firm already runs, LEAP, Clio, Proclaim and others, reading every live matter overnight and drafting the routine work for approval. Two parts of that design answer the questionnaire. Every output goes to a qualified fee earner for sign off before anything leaves the firm, so the answer to who approved this is a name and a time, and the audit trail records what was done and by whom. Research answers carry a citation to the source, and flags come from deterministic rules rather than model output. The same pass runs inside Bracton, the case and client management platform, where the matter record and the compliance record sit together.
Run the cheap test this week. Ask for a list of every AI tool anyone in the firm uses on client work, then read it against the software the firm pays for and against what the last client questionnaire was told. The first written exercise Bracton sells reads client ledgers, the cash book and bank statements against the SRA Accounts Rules, and nothing else. That makes the client account the place to judge the reading on records you already understand, and to decide afterwards how much of the same discipline you want over your files: book a client account review.